Privacy policy

This policy applies when you book with us on our website and booking pages, use our app for iPhone and Android, book with us through Bruce, or contact us. 1. Who is the data controller Sama Pilates ApS CVR 45814971 J.C. Jacobsens Gade 9 1799 Copenhagen V, Denmark Email: [email protected] We are not required to have a data protection officer (DPO). 2. What we process, and why Your account and contact details Name, email and phone number. We use them to create your account, handle your bookings and purchases, and send you confirmations, receipts and important messages about your bookings. Legal basis: Article 6(1)(b) GDPR (contract). Date of birth When we ask for it, because the price or VAT of a service depends on your age. Legal basis: Article 6(1)(b) and (c) (contract and legal obligation). Address Only when it has to appear on an invoice. Legal basis: Article 6(1)(c) (the Danish Bookkeeping Act). Profile photo Only if you choose to add one. Legal basis: Article 6(1)(b). Bookings and purchases Your bookings, attendance, class packs, memberships and purchases. We use them to provide our services and for bookkeeping. Legal basis: Article 6(1)(b) and (c). Payment Card, Apple Pay and Google Pay payments are handled by Stripe. We never see your full card number. Stripe is an independent controller for the payment data it processes. Bookings through Bruce If you book with us through Bruce, we receive your name, email and booking from Bruce so we can welcome you and record your attendance. Legal basis: Article 6(1)(b). Your location (app only) When you check in in the app and have given the app access to your location, we compare your phone's position with the studio's to confirm you are there. The position is only used for that comparison and is not stored. Legal basis: Article 6(1)(b). Notifications (app only) If you allow notifications, we store a notification ID for your phone so we can send you reminders and messages about your bookings. You can turn notifications off in your phone's settings. Legal basis: Article 6(1)(b). App usage and error reports When you use the app, we record which parts of the app are used, as well as crashes, errors and how quickly the app responds, together with an ID for your account and your device. We do not record what you type. We use this to make the app work and to improve it. Legal basis: Article 6(1)(f) (our legitimate interest in an app that works). When you contact us When you write to or call us, we process the information you give us, usually name, email and phone number, so we can reply. We delete the correspondence once it is clear whether you want our services, unless in a particular case we need to keep it longer. Legal basis: Article 6(1)(f). Newsletters and marketing We only send newsletters and offers if you have said yes to them. You can always withdraw your consent, for example via the link in our newsletters or by writing to us. Legal basis: Article 6(1)(a) (consent). The app shows no ads and does not track you across other apps and websites. 3. Signing in with Ferb You sign in with your phone number and a one-time code sent by text message. Sign-in and your account are handled by Ferb ApS, which provides our booking and payment system and our app. Ferb is an independent controller for your Ferb login (including your phone number, sign-in and security), which you can use at several studios. Read more in Ferb's privacy policy at ferb.co/privacy-policy. 4. Who we share data with We never sell your personal data. Ferb ApS is our data processor and stores and processes the information about your bookings, purchases and memberships on our behalf. Ferb itself uses sub-processors, for example for hosting, sending emails and text messages, and error reporting. Ferb provides the list on request to [email protected]. We have data processing agreements with the companies that process personal data on our behalf. In addition, these companies receive data as described above: - Stripe, when you pay. - Bruce, when you book with us through Bruce. - Apple and Google, which deliver notifications to your phone. We also disclose information to public authorities where the law requires it. 5. Transfers outside the EU/EEA We and Ferb use suppliers in the EU/EEA as a starting point. Some suppliers, for example Stripe, Google and Apple, may process data outside the EU/EEA. This is done on the basis of the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework. 6. How long we keep your data, and how to delete your account We keep your data for as long as you have an account with us. You can delete your account in the app under Profile → Personal info → Delete account, or at samapilates.ferb.co/delete-account. The account is deleted 30 days after your request, or later if you have a membership with a binding or notice period, or a booking further ahead. Until then you can change your mind. Under the Danish Bookkeeping Act we must keep invoices, receipts, payments and bookings for 5 years from the end of the financial year they belong to. We therefore keep them, also after your account is deleted. When your account with us is deleted, you still have your Ferb login. You can have it deleted by writing to [email protected]. 7. Automated decisions We do not make decisions about you based solely on automated processing, including profiling. 8. Your rights Under the GDPR you have the right to: - access the data we process about you - have incorrect data corrected - have your data erased - have the processing restricted - object to our processing, including always to direct marketing - receive your data in a structured, machine-readable format (data portability) - withdraw a consent, without affecting the processing that took place before Write to [email protected] if you want to use your rights. You can read more about your rights at datatilsynet.dk. 9. Complaints You can complain to the Danish Data Protection Agency (Datatilsynet) if you are unhappy with how we process your personal data. You find its contact details at datatilsynet.dk. 10. Changes We update this policy when we change how we process personal data. The date at the top shows when it was last changed.

Sama Pilates uses Ferb for bookings, payments and its app. How Ferb handles your data